Three pieces of standards work moved far enough this year that we have started writing them into the specifications we put in front of clients. Two answer those exact questions. The third is a quiet deprecation that will outlast many systems going in now.

How cloud video became a one way street

On premises, camera interoperability has been settled for well over a decade. ONVIF, the standards body that has shaped it since 2008, now counts upward of 33,000 conformant products, with separate profiles for live streaming, local recording, access control, and analytics metadata. A recorder from one manufacturer pulls a stream from another manufacturer's camera because both agreed on the same conversation.

Then recording moved to the cloud, and that agreement stopped at the firewall. Each manufacturer invented its own way of getting a camera out to a hosted service, proving the camera was the camera, and parking recordings in storage. Hardware and subscription became a single purchase, so leaving the service meant buying the cameras again. That is why the accounting conversation ends in a shrug.

What Profile V puts on paper

On July 9, 2026, ONVIF published a Release Candidate for Profile V, a specification for cloud based video surveillance, sometimes sold as video surveillance as a service. The camera reaches outward itself, holding open a WebSocket Secure connection ONVIF calls an Uplink, which is how a cloud client gets to a camera behind a firewall with nobody forwarding ports or standing up a VPN. Live video travels over WebRTC to a web based client, with two way audio on products whose hardware supports it. Event notifications come back as pull point messages riding that same Uplink, or as JSON over MQTTS. Recordings land in cloud storage, Amazon S3 and Azure Blob Storage among the named targets, encrypted before they leave the camera. Configuration can be handled from a conformant cloud client as well.

Profile V can be combined with ONVIF video and access control profiles, so a hybrid system keeping some recording local is still in scope, and ONVIF expects to finalize the specification at the end of 2026. Leo Levit, chairman of the ONVIF board of directors, framed the intent plainly, saying that as more security systems move to the cloud, the organization wants that shift to give customers more choice rather than less.

The security requirements live in add ons now

Profile V does not stand alone. Conformant products must also implement the Profile V Security Add on, itself a Release Candidate, which handles authorization through OAuth 2.0 with mutual TLS and access tokens, so nothing unapproved joins the exchange, and which requires recordings to be encrypted on their way into storage.

Putting those requirements in a companion document is a deliberate choice, and a sensible one. Profiles are fixed feature sets, which makes them good for interoperability and useless for keeping up with cryptography. Add ons are versioned, so they can be revised without a new profile cycle and without asking anyone to rebuild a working system. ONVIF applied the model again on September 9, 2026, with a Release Candidate for version 2.0 of its TLS Configuration Add on, which lets a conformant video management system configure or update TLS settings on a device and which ONVIF says strengthens how that traffic is protected.

Signing the footage where it is born

The insurer's question got its answer on August 26, 2026, when ONVIF released a Media Signing Add on as a Release Candidate. A conformant camera or video encoder cryptographically signs encoded video at the moment of creation. What the device embeds binds the footage to the hardware that captured it and guards the signed run of frames against alteration, so any tool built to the specification can tell a reviewer whether a clip is intact and where it came from, even after it has passed through several systems. The Release Candidate covers H.264 and H.265 video, with audio planned for a later version, and ONVIF has published the signing and verification framework as open source on GitHub.

Signed video also survives ordinary handling. Copy it, export it, hand it to an adjuster, and it remains checkable, so long as the signature and the data needed to test it ride along untouched. ONVIF presents the add on as reinforcement for chain of custody practice, not a substitute for it. In June 2025 ONVIF joined the Coalition for Content Provenance and Authenticity as a liaison member and set out to align its video authentication specification with Content Credentials, the provenance standard from a foundation whose founders include Adobe, Microsoft, Intel, and the BBC.

What a signature actually proves

It is worth being precise, because marketing around authenticity tends to overreach. NIST examined the technical approaches in its November 2024 report on reducing risks posed by synthetic content. A signature on metadata, the report explains, establishes that whoever signed vouched for the content and that nothing has shifted since. It does not establish that the metadata is truthful, and NIST is frank about where the scheme fails, naming compromised certificate authorities and leaked private keys. Watermarking holds up less well, because researchers have stripped or faked most methods in use. The report lands on the view that nothing available today works alone.

That is not a reason to skip signing but a reason to treat it as one strong link rather than the whole chain. Who had access to the device, and whether its clock was right, remain questions for your commissioning records.

The deprecation nobody mentioned to you

While the new specifications get attention, an older one is being retired. In October 2025 ONVIF announced it would end support for Profile S, the streaming profile that launched in 2011, on the grounds that the authentication written into it no longer matches what cybersecurity practice calls for. The June 2026 build of the conformance test tools, valid for nine months, is the final one a manufacturer can use to claim Profile S conformance. Profile T, which arrived in 2018, carries almost everything Profile S did plus further video surveillance capability, and most devices and clients already handle both.

Nothing breaks. ONVIF states plainly that retiring the profile leaves installed systems running as they do today. Writing Profile S into a project now, though, buys hardware tied to an authentication model on its way out, and ONVIF's own guidance is to move away from username token authentication in favor of TLS and HTTPS or Profile T wherever possible.

Writing this into a purchase

None of this requires waiting. Specify Profile T rather than Profile S on anything you buy now, and ask any vendor pitching a hosted video service to state in writing when it will support Profile V and the Media Signing Add on, and whether the cameras in the quote will get there by firmware update or by replacement. Because all three remain Release Candidates until the end of the year, a written commitment is worth more than a logo on a datasheet. Claims are checkable. ONVIF keeps a database of conformant products it calls the “authoritative source” for deciding whether a product really is conformant, searchable by profile, add on, and manufacturer. Cameras and recorders are network edge devices, so the guidance CISA collects for protecting them belongs in the same conversation, as does its Secure by Demand guide, published with international partners for the moment of choosing a product rather than recovering from one.

We read these specifications so our clients do not have to, and this batch is welcome, because both questions at the top of this article now have real answers. If you are planning a camera system, replacing one that has aged out, or wondering what your current one would survive, we are glad to look at it with you. Reach us through our contact page or call (781) 506-6008.

Sources

ONVIF: Profile V draft for cloud video
ONVIF: Profile V specification page
ONVIF: Media Signing Add on release
ONVIF: TLS Configuration Add on 2.0 release
ONVIF: A standard for proving video is real
ONVIF: Ending support for Profile S
ONVIF: Collaboration with the C2PA
ONVIF: Conformant product search
NIST: Reducing risks posed by synthetic content
CISA: Guidance for protecting network edge devices
CISA: Secure by Demand product selection guide
CISA: Announcement of the Secure by Demand guidance

That call is about to get more common, because the clock on those certificates is getting much shorter. On October 7, 2026, Let's Encrypt announced that its default certificate lifetime will fall from 90 days to 64 days for every certificate issued or renewed on or after February 10, 2027. This is not one authority acting alone. It is a single step in a schedule the certificate industry agreed to over a year ago, and that schedule ends with certificates living 47 days.

1. What the CA/Browser Forum Actually Decided

The schedule comes from the CA/Browser Forum, where certificate authorities and browser makers write the rules publicly trusted certificates must obey. In April 2025 its server certificate working group adopted ballot SC081v3, titled "Introduce Schedule of Reducing Validity and Data Reuse Periods." Clint Wilson of Apple proposed it, with endorsements from Sectigo, Google Chrome, and Mozilla. Among certificate issuers the vote was 25 in favor and none opposed, and all four certificate consumers that cast a vote supported it.

The dates now live in the Baseline Requirements themselves, in the plainest possible language. Since March 15, 2026, the maximum validity period for a subscriber certificate has been 200 days. On March 15, 2027, it drops to 100 days, and on March 15, 2029, to 47 days. The same table shortens something less visible but equally consequential, the period an authority may reuse your domain validation data, meaning the evidence that you control the name printed on the certificate. That window also fell to 200 days in March 2026, falls to 100 days in March 2027, and reaches 10 days in March 2029.

Those two numbers moving in lockstep is the part worth noticing. Shorter certificates alone would be an annoyance you could absorb with a better calendar reminder. Shorter revalidation windows mean the proof of ownership behind each certificate must be re established almost continuously, which is only practical if a machine does it for you.

2. Why Let's Encrypt Is Moving First

Let's Encrypt is the free, automated certificate authority run by the nonprofit Internet Security Research Group, and it tends to set the pace for everyone else. In February 2026 it said publicly that its default lifetime would go from 90 days to 64 and later to 45. The October announcement attached a date to the first move. Its staging environment began issuing 64 day certificates on October 14, 2026, so administrators can test before production changes on February 10, 2027. Certificates already issued will not be revoked, and the last 90 day certificate is expected to expire on May 11, 2027. A 45 day default is planned for 2028, and subscribers can already choose 45 day or six day certificates.

Six day certificates and certificates for IP addresses became generally available on January 15, 2026. The short lived option is selected through an ACME profile named "shortlived" and runs for 160 hours. Alongside the October change, the window for reusing a completed domain authorization shrinks from 30 days to 10 days now, and to seven hours in 2028.

3. The Email That Is Not Coming

A great many businesses have quietly been relying on the expiration warning email as their safety net. That net is gone. In a post published on January 22, 2025, Josh Aas of Let's Encrypt announced that expiration notification emails would end on June 4, 2025, explaining that most subscribers now have reliable automation, that keeping the notices running meant holding millions of subscriber email addresses alongside issuance records, and that it cost the project tens of thousands of dollars annually. Nobody is going to warn you anymore.

4. Where Your Certificates Actually Live

When we audit a client network, the public website is almost never the interesting part. The certificates that cause real pain are the forgotten ones. The firewall's remote access portal. The mail server and the VPN gateway. The recorder fronting a camera system. The network controller dashboard staff reach by hostname. The copier whose web interface nobody has opened since installation day.

NIST made this point years before the current deadlines existed. In Special Publication 1800 16, "Securing Web Transactions: TLS Server Certificate Management," published in June 2020 by the National Cybersecurity Center of Excellence, the authors noted that most organizations hold far more TLS certificates than they realize, that a medium or large enterprise can run into the thousands or tens of thousands, and that responsibility for them usually sits with whichever team owns each server. Volume B opens its discussion of risk with the most mundane failure of all, outages caused by expiration.

5. Automation Is the Entire Answer

The mechanism for automated renewal is neither new nor exotic. It is ACME, the Automatic Certificate Management Environment, standardized by the IETF as RFC 8555. The newer piece is a companion standard that tells your software when to renew rather than leaving it to guess. ACME Renewal Information, published as RFC 9773 in June 2025 and authored by A. Gable of the Internet Security Research Group, lets an authority suggest renewal timing to its clients. Its stated aim is to smooth load spikes on the authority's side and keep client software from guessing wrong about how often to renew.

Let's Encrypt's own advice for the February change is a sound checklist for any business. Find out whether your ACME client implements renewal information, and test in staging first. Confirm that renewal actually reloads the service holding the certificate, because a renewed file no process has picked up protects nothing. Add alerting for failures. If renewal timing is hardcoded rather than negotiated, renew at roughly two thirds of the lifetime.

Let's Encrypt also offered one wonderfully specific instruction, telling administrators to search "cron jobs, scripts, and runbooks for hardcoded values such as 83, 80, or 60." A script renewing on day 80 of a 90 day certificate is comfortably early. Point that same script at a 64 day certificate and it never fires in time, because the certificate has been dead for sixteen days before the script wakes up. Nothing errors. Nothing warns. The site simply stops being trusted one morning.

6. What We Do Before the Deadline

The work starts with an inventory, where NIST begins its own list of recommended practices, alongside ownership, approved authorities, automation, proactive renewal, and continuous monitoring. For every certificate on a client network we want three answers written down. What renews it. What reloads once it has renewed. What tells a human when either of those fails.

Some equipment will not cooperate, which is fine so long as you know which pieces. Appliances that cannot run an ACME client need either a documented manual renewal with a named owner, or a reverse proxy in front of them that handles certificates on their behalf. Internal systems nobody outside the building reaches can often use a private authority with a long lifetime, since these rules govern public certificates. Drawing that line deliberately, rather than during an outage, is most of the value of starting early.

7. The Dates Worth Putting on a Calendar

February 10, 2027 is when Let's Encrypt defaults become 64 days. March 15, 2027 is when the industry maximum falls to 100 days and validation reuse falls with it. May 11, 2027 is when the last 90 day certificate expires, the real deadline for anything still renewing on a quarterly rhythm. In 2028 the Let's Encrypt default becomes 45 days, and March 15, 2029 brings the 47 day maximum for everyone. A few months of unhurried work now replaces a scramble later, and the business that handles this well will never notice these dates passing.

If you are not certain what certificates your network runs, when each expires, or what happens when one fails to renew, we would be glad to find out with you and build the automation that keeps it quiet. Reach us through our contact page or call (781) 506-6008.

Sources

CA/Browser Forum: Ballot SC081v3 Introduce Schedule of Reducing Validity and Data Reuse Periods
CA/Browser Forum: Baseline Requirements for TLS Server Certificates
Let's Encrypt: 64 Day Certificate Lifetimes Coming February 2027
Let's Encrypt: Shorter Certificate Lifetimes and Rate Limits
Let's Encrypt: Six Day and IP Address Certificates Are Generally Available
Let's Encrypt: Ending Support for Expiration Notification Emails
IETF: RFC 8555 Automatic Certificate Management Environment
IETF: RFC 9773 ACME Renewal Information Extension
NIST: Securing Web Transactions TLS Server Certificate Management

A short document about who is in charge

Josh.ai, a voice and control platform our team deploys in high end homes, published the first edition of a document it calls A Code of Conduct for AI in the Home. It is voluntary, it addresses any AI that can observe, reason about, recommend, automate, or control connected systems in a residence, and it is built on twelve rules. CE Pro covered the release on September 24, 2026 and reported that no other company had adopted it at that point. Josh.ai invites manufacturers, installers, homeowners, and policymakers to sign a public pledge, which the company reviews before listing. CE Pro quoted chief executive Alex Capecelatro saying that the intelligence in a home must always answer to the people who live there.

What struck us is how little of the document is about artificial intelligence and how much is about plumbing, in the engineering sense. These are the rules of a well designed control system, written down as a persuasive new layer is added on top of one.

The control system keeps the keys

The idea doing the most work is what Josh.ai calls the Home Authority Stack, a description of how permission moves through a household. The AI never touches a device directly. It can reason, suggest, and compose an entire evening scene on request, but every instruction passes through the control system, which checks it against the household permissions already in place before any device acts. The AI is a good advisor with no hands of its own.

If you have a properly commissioned Control4 or Lutron system, this is closer to your existing reality than it sounds. Scenes, schedules, keypad bindings, and user profiles already live in the controller, not in whichever app issued the last command. The code insists that the arrangement survives contact with a conversational assistant, and that the limits are engineered deliberately rather than inherited.

Off has to mean off

Two of the twelve rules matter most to the people actually living in the house. A resident can disable the AI entirely, easily, and basic manual control keeps working when they do. And core control runs locally, continuing to function when the internet connection or the cloud model is unavailable.

Those two sentences carry real design consequences. A house whose lighting depends on a remote inference call goes dark in an outage. We keep scenes, schedules, and keypad logic resident on the local controller, and we test the failure case at handover rather than during a February ice storm. Ask your integrator to unplug the modem in front of you. The answer is in what the keypads do next.

Consequence sets the bar

Another rule scales caution to stakes. The more serious or irreversible an action, the more certain the system must be before taking it, and the more likely it should be to ask first. Related rules hold that actions ought to be reversible or safely contained, and that a system uncertain about intent, identity, or outcome should do less and ask rather than guess.

In practice this sorts a house into tiers. Shades, lamps, and music are forgiving, and nobody wants a prompt before dimming a sconce. Door locks, gates, alarm disarming, and water shutoff valves sit in a different category, because a wrong guess is measured in property damage or worse. We draw that line with the client and write it into the permission model rather than leaving it to whatever the assistant feels confident about.

Privacy is a design choice, not a settings tab

The code also asks that systems use the least data necessary, keep household data from outside parties without permission, and ship secure by default with no universal default passwords. That sounds unobjectionable until you look at what regulators have had to pursue.

In May 2023 the Federal Trade Commission and the Department of Justice charged Amazon with violating the Children's Online Privacy Protection Act by retaining children's Alexa voice recordings indefinitely and failing to delete transcripts even after parents asked. Amazon agreed to a twenty five million dollar civil penalty under a proposed court order, with deletion requirements and limits on reusing that data. Samuel Levine, then director of the agency's Bureau of Consumer Protection, said the law does not allow companies to keep children's data forever for any reason, and certainly not to train their algorithms. That case is why we ask vendors where audio is processed, how long recordings and transcripts are kept, and what deletion removes.

Telling a claim apart from a credential

Every manufacturer says its products are private and secure. A handful can point to something an independent party checked, and the distinction is worth learning.

The National Institute of Standards and Technology published its profile of the IoT core baseline for consumer products, NIST IR 8425, in September 2022. It defines six product capabilities, covering asset identification, product configuration, data protection, interface access control, software update, and cybersecurity state awareness, plus four non technical ones covering documentation, information handling, and customer education. Most American device security work borrows that vocabulary.

The Connectivity Standards Alliance, the body behind Matter, built on that foundation with its IoT Device Security Specification 1.0, launched on March 19, 2024 with contributions from nearly two hundred member companies including Amazon, Google, Comcast, and Silicon Labs. It consolidates the most widely used baselines from the United States, Singapore, and Europe into provisions covering unique device identity, no default passwords written into the code, protected storage, secure updates through a published support period, and vulnerability management. Manufacturers submit evidence to an Authorized Test Laboratory, and products that pass may display the Product Security Verified Mark.

Government labeling is moving in parallel. The Federal Communications Commission adopted rules in March 2024 creating the U.S. Cyber Trust Mark, a voluntary program for wireless consumer IoT products in which accredited labs test and approved administrators authorize the label. Its QR code leads to details such as the product's support period and whether security updates install automatically. Britain took the mandatory route instead, with a product security regime effective April 29, 2024 that requires connectable products to avoid shared factory set passwords, publish a route for reporting vulnerabilities, and state their minimum security update period.

For the behavior of the intelligence rather than the device it runs on, the reference point is the NIST AI Risk Management Framework, released as version 1.0 on January 26, 2023 and organized around four functions named Govern, Map, Measure, and Manage. It was written for organizations rather than households, and the Josh.ai code reads very much like that framework translated into language a homeowner can use.

The questions we ask before AI goes in

None of this means a thoughtful homeowner should keep intelligence out of the house. The capability is very good. Josh.ai released its AI X OS platform in June 2026 after a dealer early access program, adding scene recommendations and the ability to build a scene by describing it. That is the kind of moment this industry exists for.

It does mean the evaluation deserves rigor. We ask whether the control system enforces permissions independently of the AI, whether the house still functions with the cloud unreachable, which actions require confirmation and who decided that, where voice and video are processed and how long anything is kept, and whether the manufacturer can point to a specification someone else verified. Those answers are knowable before anything is installed. Asking afterward costs considerably more.

A house that anticipates you is a remarkable thing to live in. A house that overrules you is not. The difference is decided at design time, by people who thought about it on purpose.

If you are planning a system and want the AI and privacy questions pressure tested alongside the equipment list, we can help. Reach us through our contact page or call (781) 506-6008.

Sources

Josh.ai: A Code of Conduct for AI in the Home
CE Pro: Josh.ai publishes AI code of conduct for the smart home industry
CE Pro: Josh.ai officially releases AI X OS
NIST: Profile of the IoT Core Baseline for Consumer IoT Products
NIST: AI Risk Management Framework
Connectivity Standards Alliance: IoT Device Security Specification 1.0
FCC: U.S. Cyber Trust Mark consumer fact sheet
FTC: Amazon charged over children's Alexa voice recordings
UK Government: Regulations on consumer connectable product security

This autumn, that request got a concrete answer. On September 1, the Alliance for IP Media Solutions announced that fourteen more products from eight manufacturers had passed formal IPMX certification testing, bringing the running total to sixty two certified products. The testing happened at European Broadcasting Union headquarters in Geneva during the last week of August. It was the second such event of the year. The inaugural round, held at the same Geneva facility in January and announced at ISE 2026 in Barcelona that February, had certified forty eight products from ten manufacturers. This second round matters more than the modest product count suggests, because it means the question "is this really interoperable" now has an answer you can look up instead of argue about.

What IPMX actually is

IPMX stands for Internet Protocol Media Experience. It is not a product and not a brand of switch. It is a suite of open standards and specifications for carrying professional audio and video over ordinary IP networks, assembled from pieces that already had years of service behind them. The foundation is SMPTE ST 2110, the standard suite that SMPTE describes as specifying how separate elementary essence streams are carried, synchronized, and described over IP for real time production, playout, and other professional media work. Audio leans on AES67, the AES standard for high performance streaming audio over IP interoperability, which targets latencies under ten milliseconds. Discovery and control come from the Advanced Media Workflow Association's NMOS family, principally IS 04 for discovery and registration and IS 05 for device connection management.

The glue holding those pieces together in a consistent, testable shape is the TR 10 document series published by the Video Services Forum. That series is where IPMX gets specific. TR 10 1 fixes system timing and definitions. TR 10 8, finalized this year, sets the NMOS requirements. TR 10 15 Part 1 defines how JPEG XS compressed video is carried, and TR 10 11 handles constant bit rate compressed video. Each part is public, which is what open means here.

What separates ST 2110 from the older practice of pushing HDMI around a building is that video, audio, and ancillary data travel as independent streams. SMPTE notes that the design makes it possible to route and break away ancillary data separately from the audio and video, with every stream individually timed and synchronized by PTP clocks no matter which path its packets took through the network. For a commercial installation that means the podium microphone can reach the recorder without dragging a video signal along with it, and a single camera feed can land in four rooms at once without a matrix switch in the middle.

The pieces broadcast standards left out

Broadcast engineers settled the transport question years ago. Pro AV could not simply borrow their work, because our sources are different. A corporate room has laptops, media players, and video conferencing appliances feeding it, and a great many of those sources are protected with HDCP. A broadcast facility has no reason to carry HDCP protected signals, and ST 2110 contains no part that addresses it.

IPMX does. The Video Services Forum finalized TR 10 5, the HDCP Key Exchange Protocol, this year, which gives the ecosystem a published method for moving protected content across an IP fabric. Alongside it sit TR 10 13, a finalized Privacy Encryption Protocol, and TR 10 14, a draft covering USB extension so a room's camera and touch display can reach a computer across the same network. Those are deeply practical additions, and they are the clearest signal that IPMX was designed by people who install conference rooms rather than people who broadcast football.

Compression deserves a mention as well. JPEG XS, standardized as ISO/IEC 21122, was built for exactly this job. The JPEG committee describes it as a technology with end to end delay equal to a fraction of a frame and typical compression ratios reaching about ten to one. That combination is why a 4K signal can cross a modest switch without the visible lag that makes a presenter's cursor feel broken.

What the certification mark covers

Here is the part worth reading closely if you ever sign a purchase order. Certification is not a participation ribbon. According to the published IPMX Product Qualification and Certification Requirements, a product must satisfy every Baseline Requirement, covering system timing, NMOS behavior, device behavior, and stream compatibility, and it must implement at least one Profile, such as uncompressed video, PCM digital audio, or JPEG XS. Extra features including HDCP, HDR metadata, the Privacy Encryption Protocol, and USB extension are declared capabilities layered on top, so two certified products do not automatically share every feature.

The document is equally direct about what manufacturers may claim. Products that implement IPMX technology without passing formal testing may not use the IPMX name or logo in marketing or product descriptions. That single sentence does more for buyers than any amount of trade show enthusiasm.

Testing is handled by the European Broadcasting Union against those published requirements, and the results are posted publicly in a registry at registry.ipmx.io, where each entry lists the manufacturer, the product, its functional category, its certification number, the profiles it supports, and whether it carries HDCP and privacy encryption. Sam Recine, who chairs the IPMX Pro AV Working Group at AIMS, put the reasoning plainly in the September announcement: "Interoperability claims are easy to make and hard to verify. This program gives the industry an independent answer."

How to put this in a bid

The practical move is small and powerful. Stop writing "AV over IP" into specifications and start writing "IPMX Certified," then name the profile and the capabilities the room genuinely needs. A boardroom with HDCP protected laptops and a soft codec needs the HDCP capability. A video wall running synchronized content needs the uncompressed or JPEG XS profile and a network engineered for PTP and multicast. A digital signage network pushing playlists to retail screens may need neither content protection nor uncompressed transport, which keeps the budget sensible.

Then verify. Ask the integrator for the certification number of every transmitter, receiver, and gateway in the proposal, and look each one up yourself. Checking the registry costs nothing but a few minutes. That habit alone separates a system you can extend in 2030 from a collection of boxes that only work with their own siblings.

We should be honest about the limits. Sixty two certified products is a real ecosystem but not a complete one, and certification tells you two devices conform to the same published rules, not that your network is ready to carry them. Precision timing, multicast routing, bandwidth headroom, and switch selection are still design work, and a certified endpoint on an unprepared network will disappoint you. If you want to understand that layer, AIMS launched a free online IPMX training series in June of this year, organized into Foundations, Systems, and Networks levels and available at training.ipmx.io.

Why we are enthusiastic about this

Open standards are slow and unglamorous. They also outlive vendors. We have walked into buildings where a perfectly healthy ten year old video distribution system had to be ripped out wholesale because the manufacturer discontinued the one receiver model that spoke its private dialect. Independent testing with public results is the mechanism that prevents that story from repeating, and after two certification events in a single year, it is finally real rather than promised.

If you are planning conference rooms or a signage rollout and you want the specification written so the system is still serviceable a decade from now, we would be glad to help. Reach us through our contact page or call (781) 506-6008.

Sources

AIMS: Certification of 14 additional IPMX products
AIMS: Certification of the first 48 IPMX products
IPMX: Product qualification and certification requirements
IPMX: Certified product registry
IPMX: What IPMX is built on
Video Services Forum: The TR 10 document series
SMPTE: The ST 2110 standards suite
AES: AES67 streaming audio over IP interoperability
AMWA: NMOS specifications
JPEG: JPEG XS overview
AVIXA: IPMX certification week wrap up
AIMS: Official IPMX training series

That is finally changing, and this month it stopped being theoretical. Locks certified under the access control standard called Aliro have begun reaching store shelves, which means the credential that opens a door can live in a phone or a watch without committing the owner to one manufacturer's private ecosystem.

What the standard actually settles

Aliro comes from the Connectivity Standards Alliance, the same organization behind Matter, and version 1.0 was published on February 26, 2026. The Alliance describes it as a communication protocol and credential standard governing how a user device speaks to an access point. In practice it defines two kinds of participants: phones and wearables on one side, electronic locks and readers on the other. The Alliance is explicit that the target is not only the front door of a house, naming corporate buildings, hospitality, universities, single family homes and multi family properties as intended settings.

The problem being solved is not technical novelty. Digital keys have existed for years. They simply did not travel. A credential issued for one brand of lock meant nothing to another, and a reader from one manufacturer pushed every phone in the building into that manufacturer's app. Tobin Richardson, the Alliance's president and chief executive, framed the release as work that "is solving the fragmentation that has held back digital key adoption, replacing it with a single interoperability standard." The Alliance counts more than 220 member companies overall, spanning lock makers, chip vendors and mobile platforms.

Three radios, three different moments

What makes the specification interesting to anyone who installs hardware is that it refuses to pick a single radio. Near field communication, running at 13.56 MHz, handles the deliberate tap. Bluetooth Low Energy, on 2.4 GHz, handles the longer range exchange a person starts on purpose, and Samsung Research describes it as the layer performing discovery and the opening signaling. Ultra wideband, operating by default on Channel 9 between 7.75 GHz and 8.25 GHz, is what lets a door open without anyone reaching for anything. Samsung's team calls it the intent layer, the part distinguishing a walk toward the door from a pause beside it. Samsung Research also notes a power reserve mode on the tap path, which keeps a credential working on a phone whose battery has run down.

Why ultra wideband matters more than it sounds

Ultra wideband separates this generation of locks from the last. The FiRa Consortium, which shepherds interoperability for the technology, explains the mechanism plainly. The radio uses a very wide channel of 500 MHz and emits pulses roughly two nanoseconds long. Distance is measured by timing the round trip of challenge and response packets, a technique known as time of flight, and the result lands within centimeters.

That precision is a security property, not a convenience. The classic attack against passive entry is the relay, in which an attacker captures the signal from a credential sitting on a kitchen counter, amplifies it, and presents it at the door. FiRa's explanation of why ultra wideband resists this is elegant. Relaying costs time, added time reads as added distance, and the lock concludes the phone is farther away rather than closer. The underlying amendment, IEEE 802.15.4z, adds physical layer protection against the attacks known to work against earlier ultra wideband radios.

The security model underneath

The credential rests on asymmetric cryptography, which the Alliance names directly in its announcement and which Samsung Research describes as the reason an Aliro credential cannot be cloned or spoofed. Two properties matter for buildings. The exchange at the door is point to point, so a lock needs no live internet connection to decide whether to open, and the design keeps personal information out of the conversation, passing only the authorization a transaction requires.

The Alliance also operates a certification program with supporting test suites administered through authorized test labs. For integrators this is the most consequential sentence in the whole announcement, because a logo on a box is worth something only when an independent laboratory had to agree with it before the box shipped.

What is actually shipping

The first consumer evidence arrived on September 25, 2026, when ULTRALOQ introduced three locks. The Bolt Pro at $269.99 and the Latch 5 Pro at $249.99 are certified for both Aliro and Matter, and both accept credentials held in Apple Wallet and Samsung Wallet alongside fingerprint and keypad entry. A third model, the Bolt Mission at $299.99, pairs ultra wideband with radar based presence sensing and is listed as Matter certified. The manufacturer lists availability through its own channels and Amazon now, with distribution through The Home Depot beginning in October.

Three locks from one company is not an industry transition, but it is the first time a homeowner can buy a lock off a retail shelf and expect the credential inside it to behave like a standard.

What Aliro does not replace

Enthusiasm for wallet based entry tends to outrun what the specification actually covers. Aliro governs the conversation between a user device and the hardware on the door. It does not govern the controller behind that door, the audit trail an insurer may ask to see, the link between an access list and payroll records, or the fire code deciding how an opening behaves when an alarm sounds. Those remain the work of a properly designed access control system, and in a commercial building they are most of the work.

The Alliance is equally clear that Aliro and Matter are complementary and independent. A device may support either or both, and neither requires the other, a distinction that matters the moment a client reads a product page and assumes one certification implies the other.

Credential strength is also only one variable in a risk decision. NIST Special Publication 800 116 Revision 1, issued in June 2018 as guidance for using federal identity credentials in facility access, rests on exactly that premise, describing a risk based strategy for choosing authentication mechanisms rather than applying one uniformly. A phone at a suite door and a phone at a server room are not the same problem, and treating them identically is how good hardware produces a bad outcome.

What to do about it now

For a house under construction, the useful move is unglamorous. Prepare the openings and the pathways before the finishes go on. Confirm the backset and handing of every door against the hardware intended for it, run low voltage cable to any opening that might one day carry a reader instead of a standalone lock, and make sure wireless coverage reaches the entries rather than stopping politely at the foyer. Cutting a reader into a finished stone surround is expensive in a way that planning for it at framing never is.

For a business, the question is sequencing. If your readers are approaching the end of their service life, a standard carrying this much mobile platform support is a reasonable thing to plan a replacement cycle around. If the system went in last year, the sensible next step is an inventory. Know which credentials are in circulation, who holds the authority to revoke them, and how long revocation actually takes when somebody resigns on a Friday afternoon. That discipline is what fails in most buildings, and no radio protocol repairs it.

If you are building, renovating, or simply tired of not knowing how many keys to your building exist, we are glad to walk the openings with you and put a plan on paper. Start on our contact page or call (781) 506-6008.

Sources

Connectivity Standards Alliance: Introducing Aliro 1.0
Connectivity Standards Alliance: Aliro frequently asked questions
FiRa Consortium: How ultra wideband works
Samsung Research: Standardized access control between mobile device and door lock
ULTRALOQ: Next generation smart lock collection
NIST: Guidelines for the Use of PIV Credentials in Facility Access

The three pricing models

Hourly work is the simplest arrangement. You call, we fix, you pay for the time. Published pricing guides from established managed providers commonly quote roughly $150 to $350 an hour, with specialist work such as cloud architecture or security engineering at the upper end of that band. Treat those as commonly quoted ranges rather than survey data, because no neutral body publishes rate benchmarks for this industry. Hourly suits businesses with occasional needs and in house staff who handle the daily work.

Monthly retainers, usually called managed IT, price the relationship instead of the incident. Providers typically quote per user per month or per device per month, and published guides cluster between roughly $150 and $400 per user per month depending on what is bundled. What you are buying is capacity and prevention: monitoring, patching, backup verification, a help desk with a written response commitment, and someone whose job is to notice problems before you do.

Fixed scope pricing covers a defined project with a defined outcome, such as an office move, a firewall replacement, a Microsoft 365 migration, or a camera and access control installation. The virtue of fixed scope is that the risk of estimating sits with us rather than with you, which is exactly why the scope document deserves careful reading on both sides.

Two variations are worth knowing. Co managed IT supplements an internal team rather than replacing it, often at a lower per user rate, and a virtual CIO engagement buys strategy without day to day support.

What the market actually spends

Kaseya's 2026 State of the MSP report, based on 1,061 providers surveyed in November 2025, found that 30 percent of providers now report average monthly revenue of $1,000 or less per client, up from 24 percent a year earlier, while the share reporting clients who spend $25,000 or more a year fell from 75 percent to 41 percent. Read that as a market where buyers are committing more cautiously and expecting sharper value, which we think is healthy.

What is usually included

A well constructed managed agreement generally covers remote monitoring and management of servers, workstations and network gear, operating system and application patching, endpoint detection and response, backup monitoring with periodic restore testing, multifactor authentication enforcement, and unlimited remote help desk within stated hours against a written response target.

What usually sits outside the monthly fee is just as important. Project labor such as migrations and new deployments is typically quoted separately. Hardware and software licensing are passed through, often with a modest procurement markup. Onboarding is frequently a one time fee, because the first sixty days involve documenting an environment nobody has documented before. After hours emergency work, onsite visits beyond a stated allowance, advanced security add ons, and compliance documentation are also commonly billed apart from the base agreement. None of this is objectionable. It only becomes a problem when it is discovered rather than disclosed.

What drives your number

Six factors move price more than anything else. The first is simply how many people and how many devices we support. The second is complexity: one office with a flat network is a different animal from four sites, a warehouse with rugged scanners, and a VPN to a manufacturing line. The third is how much of the work must happen onsite, which matters across a service area as spread out as New England. The fourth is your response time expectation, because a fifteen minute commitment at 2 a.m. requires staffing that a next business day commitment does not.

The fifth is compliance. A dental practice under HIPAA, a registered investment adviser, a defense supplier working toward CMMC, or any business holding personal information about Massachusetts residents under 201 CMR 17.00 requires documentation, controls, and evidence that a general business does not. The sixth is the current state of the estate. Deferred maintenance is real debt, and the first quarter of a new agreement usually costs more effort than the fourth.

Estimating the return

We encourage clients to build the business case on three numbers they can defend. The first is the cost of downtime. In the 2025 Calyptix and ITIC small business security survey of 715 organizations, 37 percent of small and midsize businesses estimated downtime at $1,000 to $5,000 per hour, and 8 percent put it above $25,000 per hour. Multiply your own figure by the hours you actually lost last year.

The second is labor recovered. If a manager spends four hours a week on technology triage, that is roughly two hundred hours a year that belongs somewhere else. The third is risk transferred: the cost of one ransomware event, one failed restore, or one compliance finding, weighted by how likely it honestly is.

Set those three against the annual fee and the picture usually becomes clear quickly. If it does not, the honest recommendation may be a smaller engagement, and we will tell you so.

Questions worth asking any provider

Ask what is excluded rather than what is included, since the exclusions are where surprises live. Ask for the response commitment in writing, how it is measured, and what happens when it is missed. Ask whether onboarding is separate, what the term and exit terms are, who owns the documentation and credentials if you leave, and what your rate does at renewal. A provider who answers all of that plainly is telling you how the relationship will feel in month eighteen.

Get a straight number for your environment

We quote after we look, never before, because an accurate number requires seeing the environment. If you would like a clear proposal with the inclusions and exclusions written down, email lpatel@lavitsolutions.io, call (781) 506-6008, or book a free consultation. LavIT Solutions supports businesses across Massachusetts, New Hampshire and the wider New England region.

Frequently asked questions

Is managed IT cheaper than hiring someone? It depends on scale. The Bureau of Labor Statistics put the median wage for network and computer systems administrators at $99,130 a year as of May 2025, and a fully loaded salary lands well above that once benefits and training are counted. Below roughly thirty users, a retainer usually wins. Above that, a hybrid of internal staff and co managed support often wins.

Why do providers quote per user rather than per device? Because people, not machines, generate tickets. A single employee with a laptop, a phone and a desktop consumes support roughly like one person, not like three devices.

Should I expect a long contract? Twelve months is common, and it lets a provider invest in onboarding. What matters more is the exit clause: a fair agreement lets you leave with your documentation, your credentials and your data.

Sources

Kaseya: 2026 State of the MSP report
Calyptix and ITIC: 2025 SMB security survey on downtime cost
Bureau of Labor Statistics: Network and computer systems administrators
Commonwealth of Massachusetts: 201 CMR 17.00
VC3: Managed IT services cost and pricing guide 2026

Here are the ten checks we recommend to businesses across New England, in the order we would run them.

1. Examine their own security posture first

A provider's internal practices matter more than their brochure. Ask whether multifactor authentication is enforced on their remote access and management tools, whether administrative credentials are unique per client rather than shared, and how they segment their own network. The joint advisory issued by CISA and its international partners on protecting managed service providers and their customers is explicit on these points, and it warns specifically against reusing administrative credentials across customers.

2. Read the certification, not the logo

A SOC 2 badge on a website tells you almost nothing. Ask for the report itself and check three things: whether it is Type II rather than Type I, when the observation period ended, and which trust services criteria were in scope. If the period ended more than a few months ago, ask for a bridge letter. The same discipline applies to ISO/IEC 27001:2022, where the certificate scope and the statement of applicability tell you what was actually assessed.

3. Ask which control framework they follow

Good providers can name the standard they work from. The Center for Internet Security released CIS Controls version 8.1 in June 2024, adding a governance function, and its Implementation Group 1 is described as essential cyber hygiene for smaller organizations. A provider who says they follow CIS Implementation Group 1, or the NIST Cybersecurity Framework, is giving you something you can verify. A provider who says they follow best practices is giving you a phrase.

4. Treat them as a supply chain risk, because they are

This is not theoretical. The 2021 Kaseya VSA incident reached roughly 1,500 downstream businesses through their providers, and the 2025 ConnectWise ScreenConnect breach, which a nation state actor used to reach a small number of customer instances of a tool many providers use daily. Verizon's 2026 Data Breach Investigations Report found third party involvement in 48 percent of breaches, a sixty percent increase year over year. Ask what happens to you if their tooling is compromised, and ask it out loud.

5. Put the service level agreement under a lamp

No standards body publishes an IT support service level template, so the quality varies enormously. Look for severity tiers with plain language definitions, a response commitment separate from a resolution target, the hours those commitments apply, an escalation path with names or roles, and what remedy exists when a target is missed. Vague language such as prompt response is a decision to measure nothing.

6. Insist on documentation you own

Ask what documentation you receive and when. Network diagrams, an asset inventory, credential records and written runbooks should be yours, maintained during the engagement rather than assembled at the end. The UK National Cyber Security Centre guidance on choosing a managed service provider, published in November 2025, names the service level agreement, clearly defined roles, responsibilities and liabilities, incident notification, regular reviews and reporting, least privilege access, and a clear process for contract review, renewal or termination as contract items, and that guidance travels well on this side of the Atlantic.

7. Ask how changes get made

Most outages we are called in to clean up began with an unannounced change. ITIL 4 describes change enablement as maximizing successful changes by assessing risk, authorizing the change, and managing the change schedule, and it separates standard changes that are pre approved from normal changes that need authorization and emergency changes that are expedited. You do not need your provider to be certified. You need them to be able to describe their process without inventing it on the call.

8. Ask about logging and visibility

The CISA advisory on managed service providers recommends enabling and improving monitoring and logging, and retaining important logs for at least six months. Ask what is logged, how long it is kept, and whether you can see it. A provider who cannot show you a report is a provider who cannot show you an incident.

9. Agree on the numbers you will both watch

Agree in advance on a small set of measures and a cadence for reviewing them. First contact resolution, mean time to resolve, customer satisfaction and ticket backlog are the usual four. Two cautions from the benchmarking literature. SQM Group, which sells first contact resolution benchmarking, reports an all industry average around 71 percent and considers 80 percent or better world class. And mean time to resolve should be measured in business hours rather than calendar hours, as the HDI Metric of the Month work by Jeff Rumburg has long argued, otherwise a Friday afternoon ticket looks like a catastrophe.

10. Check references like an auditor, not a shopper

Ask referees three specific questions. When something went wrong, how quickly were you told, and by whom? Have you ever asked for a report or a log and received it? And what did offboarding look like for a client who left? The Federal Trade Commission's guidance on vendor security for small businesses makes the underlying point plainly: establish a process so you can confirm that vendors are following your rules, and do not just take their word for it.

Red flags we would not ignore

A compliance logo with no report behind it. Shared administrative credentials across customers. No multifactor authentication on their own tools. Reluctance to name a response commitment. Documentation described as proprietary. An agreement with no exit path for your data and credentials. Any one of these is a conversation. Two of them together is an answer.

Talk to us

We are happy to be evaluated against this list, and we will hand over the evidence rather than the adjectives. Email lpatel@lavitsolutions.io, call (781) 506-6008, or request a consultation. LavIT Solutions works with businesses throughout Massachusetts, New Hampshire and New England.

Frequently asked questions

Does an IT consultant need SOC 2 or ISO 27001? Neither is legally required for most engagements, but one of them is meaningful evidence that a provider is audited against a standard rather than self assessing. If a provider has neither, ask which framework they follow and how they demonstrate it.

What should a service level agreement actually promise? At minimum, severity definitions, a response time per severity, the hours those times apply, an escalation path, and a stated remedy when a target is missed. Resolution targets are helpful but should be separate from response.

Who owns the documentation and passwords? You should. Agree in writing that network documentation, asset inventories and credentials are your property and will be handed over in a usable format if the relationship ends.

Sources

CISA: Protecting against cyber threats to managed service providers and their customers
National Cyber Security Centre: Choosing a managed service provider
Center for Internet Security: CIS Controls implementation groups
Verizon: Data Breach Investigations Report
Federal Trade Commission: Cybersecurity for small business, vendor security
CISA: Kaseya ransomware attack guidance for affected providers and customers
Help Net Security: ConnectWise ScreenConnect customer instances compromised
AXELOS: ITIL 4 change enablement practice
SQM Group: First contact resolution benchmarks

Here is what we would look for in 2026, informed by the founders we work with across the Boston and Manchester corridors and by what the current research actually shows.

Architecture judgment, not tool preferences

Ask a prospective consultant how they decide, not what they prefer. Both major clouds publish a well architected framework for exactly this purpose. Amazon's framework organizes decisions around six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. Microsoft's Azure equivalent uses five, dropping sustainability. Either gives a startup a vocabulary for tradeoffs and a way to review a design before it calcifies.

A good advisor will also tell you when the boring answer is correct. A managed database and a container service will carry most early stage products further than a bespoke platform, and the engineering hours saved are runway.

Credits, used deliberately

Cloud credit programs are real money and worth planning around. Amazon Web Services Activate offers up to $5,000 for bootstrapped founders and up to $200,000 for portfolio companies backed by a participating accelerator or fund. Microsoft for Startups Founders Hub advertises up to $150,000 in Azure credits. The Google for Startups Cloud Program publishes $200,000 for early stage companies and up to $350,000 for companies building in artificial intelligence. Amounts change without notice, so verify them the week you apply.

The trap is architecting for credits that expire. A consultant worth hiring will model what the bill looks like the month after they run out.

Cost control from the first month

Cloud waste is not a rounding error. Flexera's 2026 State of the Cloud report, based on 753 cloud decision makers and published in March 2026, found that 29 percent of cloud spend is wasted, the first increase in five years, with artificial intelligence workloads a significant driver. The FinOps Foundation's 2026 State of FinOps survey, covering 1,192 respondents representing more than $83 billion in annual cloud spend, found that 98 percent of organizations now manage artificial intelligence spend, up from 31 percent two years earlier.

The practices that move the number are unglamorous and effective: tag everything from day one so costs can be attributed, rightsize before committing, and only then buy commitments. Amazon's Savings Plans offer up to 72 percent off on demand pricing for one or three year commitments, and Google offers committed use discounts on a similar principle. Commitment before rightsizing simply locks in the waste.

Delivery practice that holds up under growth

Ask how they measure delivery. The DORA metrics remain the standard: deployment frequency, change lead time, change fail rate, failed deployment recovery time and deployment rework rate. The 2025 DORA report, published in September 2025 and based on nearly five thousand technology professionals, found that ninety percent use artificial intelligence at work and that adoption correlated positively with throughput but negatively with delivery stability. Its framing is the useful part for founders: artificial intelligence is an amplifier of whatever practice already exists. If the pipeline, tests and rollback path are weak, faster code generation will not save you. It will simply find the weakness sooner.

The security basics that unlock revenue

Early security work is commercial work. Multifactor authentication everywhere, single sign on as soon as the tool count justifies it, managed endpoint protection, encrypted and tested backups, and a written access review are the baseline that enterprise procurement teams probe. Verizon's 2026 Data Breach Investigations Report found third party involvement in 48 percent of breaches, a sixty percent rise year over year, which is precisely why your customers now scrutinize you as a vendor.

Expect SOC 2 to arrive as a sales requirement before it arrives as a compliance one. Published guidance from compliance platforms puts SOC 2 Type II auditor fees somewhere between $15,000 and $100,000 depending on scope, with readiness and tooling on top, and a first report commonly six to twelve months away for a small startup, since the observation window alone runs at least three months. Those figures come from vendors with a commercial interest, so treat them as directional. The scheduling implication is not directional at all: a Type II report requires an observation window, so the work has to start well before the deal that demands it.

Knowing when to hire instead

Consulting should have an exit path. The Bureau of Labor Statistics reported a median wage of $99,130 for network and computer systems administrators as of May 2025, and projects employment in that role to decline four percent between 2025 and 2035, noting explicitly that work is shifting to developers focused on operations and to outside providers. For most startups the sensible sequence is to buy expertise while the estate is small, hire internally when support demand becomes daily, and keep the consultant for specialist work such as security reviews and network design.

Comparing firms beyond the brand name

Four questions separate firms that look alike on a website. Who exactly will do the work, and what is the ratio of senior to junior hours in the estimate? What documentation do we receive, and does it live in our systems or yours? What does leaving look like, and how quickly can we get credentials and code? And who owns the intellectual property?

That last one deserves emphasis. United States Copyright Office guidance is clear that for commissioned work, copyright does not transfer automatically. A work qualifies as made for hire only when it meets the statutory criteria, including a signed written agreement saying so. A startup that pays for software without a signed assignment may not own what it paid for, and due diligence is a painful place to discover that.

Work with a team that plans for your second year

We help founders design the network, the cloud footprint and the security baseline that a Series A diligence process will not flinch at, and we document it so an internal hire can take it over. Email lpatel@lavitsolutions.io, call (781) 506-6008, or book a consultation. LavIT Solutions supports startups and growing companies across New England.

Frequently asked questions

When should a startup hire internal IT? Usually when support requests become a daily interruption for someone whose job is not support, which for many companies falls between twenty five and fifty employees. Before that, a consultant covers the same ground for less.

How much cloud spend is normal to waste? More than founders expect. Flexera's 2026 research put wasted cloud spend at 29 percent across surveyed organizations, so tagging, rightsizing and commitment planning pay for themselves quickly.

Do we need SOC 2 before we have enterprise customers? Not before, but earlier than the deal that requires it. A Type II report measures controls over an observation window of at least three months, so beginning at the point of demand means missing the deadline.

Sources

Amazon Web Services: Well Architected Framework pillars
Microsoft: Azure Well Architected Framework pillars
Amazon Web Services: Activate credits
Google: Google for Startups Cloud Program
Flexera: 2026 State of the Cloud report
FinOps Foundation: State of FinOps 2026
DORA: 2025 State of AI assisted Software Development
United States Copyright Office: Circular 30, works made for hire
Bureau of Labor Statistics: Network and computer systems administrators
Microsoft: Microsoft for Startups Founders Hub
Amazon Web Services: Savings Plans
Verizon: 2026 Data Breach Investigations Report
Drata: SOC 2 audit cost and timeline guidance

Start with a risk assessment that names things

A useful assessment produces an inventory and a ranked list, not a score. You cannot protect an asset nobody has written down, which is why asset and software inventory sits at the top of the CIS Critical Security Controls. The framework to organize the rest is the NIST Cybersecurity Framework 2.0, published in February 2024, which added a sixth function called Govern alongside Identify, Protect, Detect, Respond and Recover. Govern is the addition that matters most for smaller organizations, because it puts accountability and policy on the same footing as technology.

NIST publishes a Small Business Quick Start Guide for the framework aimed explicitly at organizations with modest or no security program in place, and CISA's Cross Sector Cybersecurity Performance Goals, updated to version 2.0 in December 2025, rate each recommended action for cost, impact and ease. Those two documents together make an honest thirty page plan possible for a company with no security staff.

Fix identity before anything else

Verizon's 2026 Data Breach Investigations Report, which analyzed more than 22,000 confirmed breaches, found that vulnerability exploitation overtook stolen credentials as the leading initial access vector at 31 percent. Credentials fell to 13 percent as an entry point, yet they still appear somewhere in roughly 39 percent of breaches, because attackers use them to move sideways and stay resident after they get in. The practical response is multifactor authentication everywhere it can be enforced, starting with email, remote access and administrative accounts.

Not all factors are equal. CISA ranks phishing resistant methods such as FIDO and WebAuthn security keys at the top, application based push and one time codes in the middle, and text message codes as a last resort. For most businesses the honest sequence is to get everyone onto an authenticator app quickly, then move administrators and executives to hardware keys.

Harden the estate, then keep it hardened

Hardening is where a consultant earns their keep quietly: disabling legacy protocols, removing local administrator rights, enforcing disk encryption, configuring email authentication, segmenting guest and device networks from business systems, and closing remote access paths nobody remembers opening. The finding that vulnerability exploitation now leads initial access makes patch cadence a security control rather than a maintenance chore.

Monitoring is what shortens the damage

Endpoint detection and response tooling watches behavior rather than signatures, and managed detection and response adds people who watch it around the clock. The case for the second part is the time data. Mandiant's M-Trends 2026 report, published in March 2026, put global median dwell time at 14 days, up from 11, and noted that the interval between initial access and handoff to a second actor has collapsed to as little as 22 seconds. IBM's 2026 Cost of a Data Breach study found that breaches taking more than 200 days to identify and contain cost an average of $5.65 million, against $4.32 million for those resolved faster. Those are enterprise averages, but the direction is the lesson: detection speed is the variable you can buy.

Plan the incident before it happens

NIST revised its incident response guidance in April 2025, and the revision is instructive. Special Publication 800 61 Revision 3 reorganizes incident response around the Cybersecurity Framework 2.0 functions rather than the older four phase lifecycle, which reflects how response has become continuous rather than episodic.

In practice a small business needs four things: a written plan naming who decides and who calls whom, an out of band communication method for when email is unavailable, a relationship with counsel and insurance established in advance, and one tabletop exercise a year. CISA's performance goals call for the plan to be drilled annually, and the drill is where gaps show up while they are still cheap.

Backups you have actually restored

Backups fail quietly. The discipline that matters is separation and testing: copies stored apart from the systems they protect, immutability so ransomware cannot encrypt the backup, and restore tests on a schedule. The CIS Controls call for testing recovery quarterly for a sample of assets, which is a reasonable target for most businesses and a far better answer than an annual hope.

Compliance, sized to the business

Most New England businesses are subject to more than they realize. Massachusetts regulation 201 CMR 17.00 applies to anyone, in state or out, who owns or licenses personal information about a Massachusetts resident, with no size threshold, and it requires a written information security program. Massachusetts breach notification law requires notice to affected residents, the Attorney General and the director of consumer affairs and business regulation, without unreasonable delay.

Card payments bring PCI DSS version 4, whose future dated requirements became mandatory on March 31, 2025. Defense suppliers face CMMC, whose acquisition rule took effect on November 10, 2025, beginning a phased rollout. Healthcare businesses remain under the existing HIPAA Security Rule; a proposed update that would mandate multifactor authentication and asset inventories has been delayed rather than finalized, so plan for it without claiming it is law.

What good looks like after ninety days

A serious engagement should leave behind an asset and software inventory, multifactor authentication enforced across email and remote access, endpoint detection deployed and monitored, patch compliance reported monthly, a tested backup with a documented restore, a written incident response plan with one exercise completed, and a risk register with owners and dates. That is not a product. It is a program, and it is achievable for a company of twenty people.

Let us look at your risk honestly

We run assessments that produce a ranked plan rather than a sales list, and we are glad to tell you which items can wait. Email lpatel@lavitsolutions.io, call (781) 506-6008, or request a security assessment. LavIT Solutions serves businesses across Massachusetts, New Hampshire and New England.

Frequently asked questions

What is the single highest value security control for a small business? Multifactor authentication on email, remote access and administrative accounts, followed closely by tested backups. Both address the failure modes that turn an incident into a shutdown.

What is the difference between EDR and MDR? Endpoint detection and response is tooling that detects suspicious behavior on devices. Managed detection and response adds a staffed team watching those alerts around the clock and responding. The tooling finds the problem; the service shortens it.

Does a twenty person company really need an incident response plan? Yes, and it can be three pages. Who decides, who is called, how you communicate if email is down, and what is restored first. CISA guidance calls for exercising the plan at least annually.

Sources

NIST: Cybersecurity Framework 2.0
NIST: Cybersecurity Framework 2.0 Small Business Quick Start Guide
CISA: Cross Sector Cybersecurity Performance Goals version 2.0
Center for Internet Security: CIS Controls Navigator
CISA: Implementing phishing resistant multifactor authentication
Verizon: 2026 Data Breach Investigations Report
Mandiant: M-Trends 2026
IBM: Cost of a Data Breach 2026
NIST: SP 800 61 Revision 3, incident response recommendations
Commonwealth of Massachusetts: 201 CMR 17.00
PCI Security Standards Council: PCI DSS version 4 future dated requirements

Stage one: discovery

Discovery is about your business before it is about your technology. We ask what the company does, which systems the revenue depends on, what frustrates people weekly, what is planned for the next year, and what compliance obligations apply. Engage is one of the six activities in the ITIL 4 service value chain for exactly this reason: understanding stakeholder needs is a distinct activity, not a preamble to selling.

Discovery normally takes one visit and a few conversations. It should cost you nothing but attention.

Stage two: assessment

Assessment is the technical inventory and health check. We document servers, workstations, network equipment, cloud tenants, licensing, backups, remote access and security controls, then test the things people assume are working. The reason inventory comes first is that it sits at the top of the CIS Critical Security Controls, which call for inventories of enterprise assets and software to be actively managed and reviewed at least twice a year.

You should receive a written assessment with findings ranked by risk and effort, not a list of everything wrong in alphabetical order. If backups have never been restored or multifactor authentication is missing on email, those belong at the top in language a non technical owner can act on.

Stage three: the roadmap

A roadmap turns findings into sequence and budget. Ours typically has three horizons: stabilize, which is the first thirty to sixty days and covers anything that threatens continuity; standardize, which brings the estate to a common, supportable baseline over a quarter or two; and strategic, which aligns with your business plans, such as a new location, a compliance deadline or a growth target.

Each item should carry an owner, a rough cost and a reason. Governance is not bureaucracy at this stage. It is the difference between a plan and a wish list, and the NIST Cybersecurity Framework 2.0 elevated governance to a full function in 2024 on precisely that logic.

Stage four: the statement of work

Before delivery, the scope goes in writing. Federal procurement rules offer a surprisingly good checklist for what belongs in a statement of work: a description of the work, where it happens, the period of performance, a deliverable schedule, applicable performance standards, and any special requirements. Add two more that matter in practice: what is explicitly out of scope, and how a change to scope gets priced and approved.

Scope creep is the most common way good projects go sideways. The Project Management Institute's 2018 Pulse of the Profession found that 52 percent of projects completed in the prior year experienced scope creep, up from 43 percent five years earlier. That figure is from 2018 and PMI's recent editions no longer report it, but the mechanism has not changed: undefined edges expand.

Stage five: delivery

Delivery should be unremarkable. Work is scheduled around your operations, changes are announced before they happen, and someone tells you when a milestone completes rather than leaving you to infer it. We plan disruptive work outside business hours where it makes sense, and we say plainly when something must happen during the day.

At handover you should receive documentation you own: network diagrams, an asset and license inventory, credential records in a shared vault, runbooks for the procedures your team performs, and a short summary of what changed and why. If a provider will not hand over documentation, that is a business model, not a security policy.

Stage six: ongoing support

Support is where the relationship is actually judged. Expect a written response commitment by severity, a single channel for requests with a ticket you can reference, proactive monitoring that catches failures before you report them, patch and backup reporting on a schedule, and a named person who knows your environment.

Our first ninety days follow a consistent shape. In the first thirty we complete documentation, deploy monitoring and management tooling, enforce multifactor authentication and verify backups. In the next thirty we close the urgent findings from the assessment and establish patch and reporting cadence. By day ninety we review what we found against what we expected and update the roadmap together. That is our practice rather than an industry standard, and any provider who presents a ninety day plan as a universal norm is describing a preference.

The measures worth watching

Agree on a handful of numbers and review them quarterly. Uptime for the systems that carry revenue. Mean time to resolve, measured in business hours rather than calendar hours, which is the convention the HDI metrics literature has long argued for. First contact resolution, since it reflects whether the help desk is staffed with people who can actually fix things. Ticket volume trend, which should fall as stabilization works. Patch compliance as a percentage of endpoints current. And backup restore test results, which the CIS Controls suggest testing quarterly for a sample of systems.

Two cautions. Benchmarks in this field are older and thinner than vendors imply, so compare against your own trend line first, and remember that a metric without a review meeting is decoration.

Governance and the quarterly review

Every quarter we recommend a short business review: what happened, what it cost, what is coming, and what should change. Bring budget into that conversation rather than treating technology spending as a series of surprises. For clients without an internal technology leader, this is effectively a virtual chief information officer function, and it is the part of the engagement that most often pays for itself, because it converts reactive purchases into planned ones.

What should make you uncomfortable

An engagement with no written scope. Documentation that never arrives. Changes you learn about from symptoms. A quarterly review that is really a sales meeting. No exit path for your data and credentials. Each is fixable, and the time to raise it is early.

Talk to us about your environment

If you want to know what discovery would surface in your business, we are glad to start there. Email lpatel@lavitsolutions.io, call (781) 506-6008, or book a free consultation. LavIT Solutions provides IT consulting, managed IT and AV integration across Massachusetts, New Hampshire and New England.

Frequently asked questions

How long does onboarding take? For most small businesses, documentation and tooling take two to four weeks and the urgent findings close inside ninety days. Environments with undocumented legacy systems take longer, and an honest provider will say so after assessment rather than before.

What documentation should we receive? Network diagrams, an asset and license inventory, credentials in a vault you can access, runbooks for recurring procedures, and a change summary. All of it should be yours to keep.

How do we measure whether it is working? Uptime on revenue systems, mean time to resolve in business hours, first contact resolution, ticket volume trend, patch compliance percentage, and backup restore test results, reviewed quarterly against your own baseline.

Sources

AXELOS: Introductory overview of ITIL 4
Federal Acquisition Regulation: statement of work requirements
Center for Internet Security: CIS Controls Navigator, safeguards 1.1 and 11.5
NIST: Cybersecurity Framework 2.0 and the Govern function
Project Management Institute: Pulse of the Profession 2018
HDI: Mean time to resolve as a service desk metric

October 13, 2026, is a quiet but consequential date for business technology. Two separate Microsoft timelines converge on it, and many organizations are only aware of one of them. We want to walk through both, explain what each option really costs, and describe how we would help a business sort its computers into sensible groups before the calendar forces the issue.

Where Windows 10 stands today

Microsoft ended support for Windows 10 on October 14, 2025. Since then, the only way for a business computer to keep receiving operating system security fixes has been the Extended Security Updates program, usually shortened to ESU. It is an annual subscription that delivers updates Microsoft rates as Critical or Important, and nothing more. New features and general technical support are not part of the arrangement.

According to Microsoft's lifecycle FAQ, the first year of commercial ESU coverage runs through October 13, 2026. Year Two extends to October 12, 2027, and Year Three, the final one, ends October 10, 2028. Microsoft is candid about the program's purpose, describing it as "a last resort" and a temporary bridge while customers move to a supported platform. We think that framing is exactly right.

The second deadline on the same day

Here is the detail that surprises many of the owners we speak with. Moving to Windows 11 does not end the conversation about update schedules, because each Windows 11 version has its own servicing window. Microsoft's release health documentation shows that Windows 11 version 24H2 in the Home and Pro editions stops receiving updates on October 13, 2026, the very same day Windows 10 ESU Year One concludes.

Many small businesses run Windows 11 Pro, and plenty of those machines are still sitting on 24H2 because nobody approved the next feature update. Version 25H2 of Windows 11 Pro remains in service until October 2027. Enterprise and Education editions receive a longer window, thirty six months per version instead of twenty four for Home and Pro, which is one of the quieter advantages of those licenses. So the date matters even for companies that believe their Windows 10 migration is finished.

What staying on Windows 10 costs in year two

For organizations, Microsoft sells ESU through volume licensing at $61 per device for Year One, and the price doubles with each consecutive year. A computer renewed for Year Two therefore costs $122 for that year alone. Coverage is cumulative, which means a business that skipped Year One and now wants protection must pay for the year it already missed. Microsoft also does not sell partial years, so there is no discounted option for a machine you plan to retire in March.

Renewal also involves work on the computers themselves. Businesses retrieve their ESU key from the Microsoft 365 admin center, and Microsoft's activation instructions list a separate activation ID for each ESU year, so every enrolled device has to be activated for the new year. Eligible machines must be running Windows 10 version 22H2 with specific prerequisite updates installed. Long Term Servicing editions follow their own lifecycles and are not covered by this program at all. If your IT provider has not yet confirmed a Year Two plan with you, now is the moment to ask.

Why the consumer extension will not cover an office

In June 2026, Microsoft extended its consumer ESU program for personal devices through October 12, 2027, a change BleepingComputer reported after Microsoft added a note to its documentation. The consumer option is inexpensive, and it can even be free for people who sync their PC settings, so it is tempting to assume a small business can simply enroll its computers that way.

It cannot, at least not for well managed equipment. Microsoft's own terms exclude devices joined to Active Directory or Microsoft Entra domains, devices enrolled in mobile device management, and kiosk machines. In other words, the more responsibly a company administers its fleet, the less likely any of it qualifies. Microsoft's lifecycle FAQ lists Enterprise, Education, and Pro in commercial use as the editions eligible for the business program, which is the path that applies to company computers.

Office apps are not a reason to wait

We occasionally hear that Windows 10 must still be acceptable because Outlook and Excel keep updating. Microsoft has in fact committed to security updates for Microsoft 365 Apps on Windows 10 until October 10, 2028. Feature updates, however, stop at Version 2608, after which those installations receive only security fixes. More importantly, a patched spreadsheet application offers no protection for an operating system that has stopped receiving its own updates. The two schedules are independent, and the one that counts most is Windows itself.

A cloud route worth considering

For businesses with a handful of specialized machines that cannot be replaced yet, virtualization can soften the cost. Microsoft includes ESU at no additional charge for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, and several other Azure services. Microsoft also states that Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription. For a company already planning a move toward Cloud PCs, that entitlement can turn a licensing headache into a sensible transition plan.

How we would sort your computers

Our approach begins with an honest inventory. We identify every Windows device, its edition and version, its management status, and the software it absolutely must run. Each machine is then measured against Microsoft's Windows 11 minimum requirements, which include a compatible 64 bit processor with at least two cores, 4 GB of memory, 64 GB of storage, UEFI firmware capable of Secure Boot, and a Trusted Platform Module version 2.0. Microsoft's free PC Health Check app gives a quick first answer for individual machines.

From there the decisions tend to fall into place. Compatible computers move to Windows 11, which Microsoft recommends doing through tools such as Microsoft Intune or Windows Autopatch so the rollout is managed rather than improvised. Incompatible computers that support critical work receive a Year Two ESU license along with a firm replacement date. Windows 11 Pro machines still on 24H2 are scheduled for the 25H2 feature update before mid October. Everything else is retired responsibly, with its data securely removed.

The stakes are not theoretical. The Cybersecurity and Infrastructure Security Agency includes unsupported software on its published list of bad practices, calling its use in service of critical infrastructure "dangerous." A dental practice or an architecture firm is not a power plant, but attackers rarely distinguish between them when an unpatched computer answers on the network.

The encouraging part is that this is a solvable, finite project. With a clear inventory and a few weeks of planning, most organizations can reach October 13 knowing exactly where every computer stands, and the following October will arrive with far fewer surprises.

If you would like help sorting your company's computers before the deadline, we would be glad to take a look. Contact our team or call us at (781) 506-6008, and we will help you choose the right path for every machine.

Sources

Microsoft Learn: Lifecycle FAQ, Extended Security Updates
Microsoft Learn: Windows 10 ESU program
Microsoft Learn: Enable Windows 10 ESU
Microsoft Learn: Windows 11 release information
Microsoft: Windows 10 Consumer ESU program
BleepingComputer: Consumer ESU extended to October 2027
Microsoft Learn: Microsoft 365 Apps on Windows 10
Microsoft: Windows 11 specifications
CISA: Bad Practices

Matter, the interoperability standard maintained by the Connectivity Standards Alliance (CSA), has had a remarkably busy year. Two substantial releases have landed within seven months of each other, adding cameras, motorized coverings, shared network administration, and a more demanding security certification. We have been following these changes closely because they reshape how we plan, commission, and hand over a home. Here is what matters for homeowners and builders right now.

1. Cameras and doorbells finally speak a common language

For years, video was the conspicuous gap in Matter. The CSA closed it with Matter 1.5, published on November 20, 2025. The specification defines cameras that stream live audio and video over WebRTC, support talkback in both directions, and reach remote viewers through the standard STUN and TURN protocols. It also covers pan, tilt, and zoom control, detection and privacy zones, and recording that can be continuous or triggered by events, stored either locally or in the cloud.

A follow up release, Matter 1.5.1, arrived on March 31, 2026. According to the CSA, it lets a camera send several optimized streams at once, so a single device can feed a high resolution recording while also delivering a lighter stream to a phone. It also allows a controller to ask a doorbell chime for a particular sound rather than only its default tone, which is a pleasant touch in a house with a front entry and a side door.

2. Support is arriving, but unevenly

A specification is only as useful as the platforms that implement it, and here we urge patience. Samsung announced in December 2025 that SmartThings had become the first smart home platform to support Matter cameras, naming Aqara, Eve, and Xthings as partners. Aqara followed in March 2026 with the Camera Hub G350, which 9to5Mac reported as the company's first Matter certified camera.

The open source world is moving as well. The Open Home Foundation added initial camera support to its Matter.js Server in May, and in June the Home Assistant project announced support for Matter 1.5.1, noting that Matter now runs in 38 percent of Home Assistant installations. Other ecosystems are slower. When we reviewed Google's developer documentation this week, its list of supported Matter device types did not include cameras. Our advice is simple: a Matter logo on a camera box does not guarantee that your preferred app will display its video today, so confirm support for the exact platform you intend to use.

3. Shades, gates, and garage doors join the family

Matter 1.5 also introduced a unified framework for closures. The CSA describes a single, modular approach that spans window shades, drapes, awnings, gates, and garage doors, whether a panel slides, rotates, or swings open. For homeowners, the appeal is consistency: a motorized drapery and a driveway gate can be described to any compliant controller in the same structured way.

We still specify dedicated systems such as Lutron shading and Nice gate operators where precision, quiet operation, and long term serviceability are paramount. What the new closure definitions offer is a cleaner bridge between those premium systems and the broader ecosystem your family already uses on its phones.

4. Joint Fabric changes the handover conversation

The headline of Matter 1.6, released on June 17, 2026, is a capability the CSA calls Joint Fabric. Earlier versions already let a device answer to more than one app, but each ecosystem essentially kept its own relationship with it. Joint Fabric lets several authorized controllers share administration of one common Matter network through a central datastore. The Alliance specifically cites new construction handovers, households that use more than one platform, and professionally managed properties as intended beneficiaries.

That list reads like a description of our daily work. Picture a builder who commissions lighting and climate during construction, an integrator who refines scenes and schedules, and a family that prefers two different voice assistants. A shared, well governed network could make that transition far more orderly than today's routine of resetting devices and starting over. We expect platform adoption to take time, and no major ecosystem has published a firm schedule that we could verify, but the direction is encouraging.

5. NFC setup suits the way homes are actually built

The opening scene of this article comes straight from the 1.6 release. Version 1.4.1 had already allowed setup details to live on an NFC tag, yet the commissioning itself still depended on Bluetooth Low Energy, as 9to5Mac explained. Matter 1.6 allows the entire commissioning exchange to happen over NFC. The CSA's own examples are a bulb enrolled before it is installed in a fixture and a wall switch configured before the circuit is energized.

For construction teams, this is more than convenience. Devices can be staged, labeled, and assigned to rooms at a bench, then installed by trades who never need to open an app. QR codes hidden behind faceplates or inside ceiling cans stop being a problem.

6. Smarter thermostats and safer sensors

Matter 1.6 adds Thermostat Suggestions, a standardized way for a controller or connected service to recommend a change tied to a preset. The thermostat weighs the recommendation against the occupant's preferences and context, and if it declines, it can explain why in a standard format. In practice, a comfort setting you chose deliberately should no longer be silently overridden by an automation you forgot about.

The same release standardizes event history for security sensors, lets smoke and carbon monoxide alarms report when they have been removed from their mounts, and restructures certificate revocation lists into partitioned pieces that scale more gracefully. Those are quiet improvements, and precisely the kind we like to see in life safety devices.

7. Security certification grows up

Alongside Matter 1.6, the CSA published version 1.1 of its Product Security specification. The program now looks beyond individual devices to complete systems, including companion apps, remote processes, and gateways. It also introduces two assurance tiers: Level 1, a supplier self assessment reviewed by an Authorized Test Laboratory, and Level 2, an independent assessment that includes functional testing by such a lab. The Alliance says the update addresses requirements under the European Union's Radio Equipment Directive harmonized standards and Singapore's Cybersecurity Labelling Scheme. Steve Hanna of Infineon, who chairs the working group's steering committee, said that version 1.1 "expands the scope of the program" while adding stronger routes to certification.

For a homeowner, the takeaway is practical. When two devices seem otherwise equal, a recognized security certification is a meaningful reason to choose one over the other, especially for anything with a lens or a microphone.

How we are applying all of this

Standards evolve faster than homes are built, so we design for durability. We continue to run structured cabling and Power over Ethernet to camera and doorbell locations, because a wired device is more dependable whichever protocol it speaks. We build the network on Ubiquiti UniFi with segmentation that keeps cameras and connected devices apart from personal computers. We keep the everyday experience anchored in proven platforms such as Control4, Lutron, and Josh.ai, and we evaluate Matter devices where the standard and the specific ecosystem truly support them. Above all, we verify compatibility product by product rather than trusting a logo.

If you are planning a new build, a renovation, or simply wondering whether your current devices will play well together, we would be glad to help you sort it out. Reach us through our contact page or call (781) 506-6008 to start the conversation.

Sources

Connectivity Standards Alliance: Matter 1.5 introduces cameras and closures
Connectivity Standards Alliance: Matter 1.5.1 release
Connectivity Standards Alliance: Matter 1.6 release
Connectivity Standards Alliance: Product Security 1.1
Samsung Newsroom: SmartThings adds Matter camera support
9to5Mac: Aqara releases its first Matter camera
9to5Mac: Matter 1.6 and Product Security 1.1 announced
Matter Alpha: Matter.js Server adds camera support
Home Assistant: The Matter upgrade you have been waiting for
Google Home Developers: Supported Matter device types

Here is the good news. Microsoft has just made that bring your own device room considerably smarter, and at the same time, purpose built meeting room systems have never been more capable or more manageable. For the first time in years, the choice between a laptop driven huddle room and a dedicated room system is a genuinely interesting one. We want to walk through how we think about it.

What changed this summer

Microsoft introduced a capability in the Teams desktop app called room optimization mode. According to the Microsoft 365 roadmap, it is designed so that "users can more easily use their laptop for meetings and collaboration in spaces like focus or huddle rooms that don't yet have a Teams Rooms system." Microsoft began rolling it out in the summer of 2026, and it succeeds the earlier shared display option.

In practical terms, when a laptop connects to the peripherals in a room, Teams now recognizes the situation and adjusts itself. It selects the room's audio and video devices automatically, enables speaker recognition so remote participants can see who is talking, and turns off voice isolation, a setting intended for a single person at a desk rather than a table full of colleagues. Those are exactly the small misconfigurations that derail meetings, and it is exciting to see the software finally handle them without anyone opening a settings menu.

What a BYOD room really is

Microsoft's documentation offers a crisp definition. Within its Teams Rooms Pro Management portal, a BYOD room is "any room that does not have a Microsoft Teams Room or Surface Hub." In other words, the intelligence lives in whichever laptop happens to be plugged in, while the room contributes the display, the camera, the speakerphone, and often a dock.

These rooms are no longer invisible to IT, either. According to Microsoft, the Pro Management portal can inventory BYOD rooms and their peripherals, associate them with the correct space, and report on usage and peripheral status. Discovery happens through the Teams client itself: when a user reaches the prejoin screen of a meeting, connected displays and USB peripherals are reported to the cloud, and Microsoft states that no personally identifiable data is collected.

There are sensible guardrails. A peripheral must be used by at least five unique users in the same organization before it becomes manageable, which prevents a personal webcam from being mistaken for room equipment. Automatic association also depends on peripherals with unique serial numbers and on rooms that have a room account, appear in the global address list, and are bookable through Exchange. Access to the portal requires at least one Pro, premium, or Teams Shared Device license, and Microsoft notes that the BYOD room usage report specifically requires a Teams Shared Device license.

Where a dedicated room system still shines

A dedicated Microsoft Teams Room is a different proposition. The compute lives in the room, a touch console sits on the table, and the meeting starts with a single tap whether or not anyone brought a laptop. For boardrooms, client facing spaces, and any room where the first impression matters, that consistency is hard to beat.

Licensing is more approachable than many owners expect. Microsoft's licensing documentation states that an organization can assign up to 25 Teams Rooms Basic licenses, which cover scheduling, joining meetings, content sharing, collaborative whiteboarding, and basic security and management. Rooms beyond that count need Teams Rooms Pro, which adds intelligent audio and video, front row and large gallery layouts, dual screen support, remote device management, conditional access policies, and detailed analytics. Microsoft also cautions that Microsoft Teams Shared Space licenses are not supported on Teams Rooms devices, a detail that trips up more than one purchasing department.

We also steer clients toward certified hardware. Microsoft describes its certification program as ensuring that devices meet "higher performance targets and quality metrics across the entire Teams experience." The same documentation is candid that certification evaluates hardware design and performance only, not every feature or cloud scenario, which is precisely why careful design still matters.

How we decide, room by room

Our rule of thumb is simple. Small focus rooms and huddle spaces that seat two to four people, where nearly every meeting is initiated by someone already holding a laptop, are excellent candidates for a well built BYOD configuration. With room optimization mode, a certified speakerphone or video bar, a single USB C connection, and a properly sized display, these spaces become remarkably dependable at a modest cost.

Conference rooms that host visitors, larger teams, or frequent hybrid meetings usually deserve a dedicated system. When the meeting must start on time every time, when a guest cannot be expected to install anything, or when the room is booked back to back all day, the reliability of in room compute pays for itself in recovered minutes and fewer awkward starts.

Many organizations land on a blend, and that is perfectly reasonable. What matters is that the decision is intentional, that the peripherals are consistent across similar rooms, and that IT can see all of them from one management view.

Design fundamentals apply either way

Whatever runs the meeting, physics still governs the experience. AVIXA, the audiovisual industry association, publishes a standard for display image size that ties the size of on screen content to the distance of the farthest viewer. It distinguishes between basic decision making, where viewers simply need to read and understand the content, and analytical decision making, where they must examine fine detail such as a spreadsheet or engineering drawing. That distinction alone often explains why a room with a bargain television never feels quite right.

Sound deserves the same rigor. AVIXA's audio coverage uniformity standard, ANSI/AVIXA A102.01:2022, provides a procedure to "measure and classify the uniformity of early arriving energy from a sound system across a listener area." In plain terms, every seat should hear, and be heard, about equally well. We apply that thinking to microphone placement as much as to loudspeakers, because a remote participant judges a meeting almost entirely by audio.

Finally, the network matters. A room that performs beautifully on a quiet Tuesday can falter when the office is full, so we treat meeting spaces as part of the network design rather than an afterthought.

Why this investment keeps growing

Businesses are clearly prioritizing these spaces. AVIXA's research projects that the professional AV industry will grow from $332 billion in 2025 to $402 billion by 2030, and the association reports that conferencing and collaboration technology still leads all solution areas. That tracks with what we see: owners want rooms that simply work, and they are willing to invest to get there.

We find this moment energizing. Collaboration software is growing more perceptive about the rooms it runs in, the hardware keeps improving, and a thoughtfully designed space can transform how a team works with clients and colleagues across the country.

Let's plan your meeting spaces

Whether you want to modernize a handful of huddle rooms, build a flagship boardroom, or simply stop losing the first ten minutes of every meeting, we would be glad to help you choose the right approach for each space. Contact LavIT Solutions or call us at (781) 506-6008 to start the conversation.

Sources

Microsoft 365 Roadmap: Room optimization mode in Teams (ID 564912)
Microsoft Learn: Bring your own device rooms
Microsoft Learn: Teams Rooms licensing
Microsoft Learn: Teams Rooms certified systems and peripherals
AVIXA: Display image size standard
AVIXA: Audio coverage uniformity in listener areas
AVIXA: Pro AV industry forecast to 2030

We regularly meet homeowners who waited until the finishes were complete to think about technology. The results are predictable. WiFi fades in the primary suite, a power cord trails down the stone beneath the television, and the shades remain manual because no one ran wire to the windows. Every one of those shortcomings is trivial to prevent during construction and costly to correct afterward.

If you are building or undertaking a substantial renovation, these are the five decisions we encourage you to make while the studs are still exposed.

1. Give your technology a proper home

Every sophisticated residence has a central equipment location. It houses the network core, the automation processor, audio amplification, video recording, and battery backup. Too often this critical infrastructure is relegated to a coat closet with no ventilation and no dedicated circuit.

Treat it instead as the nerve center it is. Plan for a dedicated electrical circuit, a properly sized equipment rack, and a deliberate path for heat to escape. Place it on an interior wall, elevated and well away from sump pumps and water heaters. Power deserves particular attention: it was a headline theme at CEDIA Expo 2026, where the industry increasingly treats power quality, backup, and energy management as core smart home infrastructure rather than an afterthought.

2. Wire for the next two decades, not the next two years

Wireless technology advances every year, yet the systems that never falter still rely on copper. We recommend Category 6A cable to every television, ceiling access point, camera, and office. The distinction matters: Cat6A supports 10 gigabit Ethernet across the full 100 meter channel defined by IEEE 802.3an, while standard Cat6 reaches that speed only on runs of about 55 meters or less.

That same cable increasingly carries power. The IEEE 802.3bt standard for Power over Ethernet delivers up to 71.3 watts to a device, enough for access points, cameras, keypads, and even motorized shades from manufacturers that offer PoE models. Add empty conduit from the equipment room to the attic and basement, and you can accommodate technologies that have not been invented yet with far less disruption to finished walls.

3. Engineer the wireless network deliberately

Stone, steel, and spray foam insulation are wonderful for aesthetics and efficiency, but they are formidable obstacles for radio signals. A single router in the basement cannot serve a large home, and consumer mesh kits struggle once dozens of cameras, speakers, and sensors join the network.

This is where the latest standards become genuinely exciting. WiFi 7, certified by the WiFi Alliance in January 2024, introduces 320 MHz channels and Multi Link Operation, which lets a device send and receive data over multiple links, often across different bands, for greater speed, lower latency, and better reliability. To realize those benefits, we design coverage from your floor plans and mount access points on the ceiling, each hardwired back to the rack. The outcome is strong, consistent performance from the garage to the far edge of the patio.

4. Make lighting and shading part of the architecture

Few upgrades transform daily life as profoundly as intelligent lighting. With a system such as Lutron, a single button can compose the entire first floor for an evening gathering, and departing the house can extinguish every light at once.

The details, however, must be addressed early. Lutron's RadioRA 3 wireless devices such as Maestro dimmers, Pico remotes, and shades, for example, need to sit within 30 feet of a processor or repeater, Sunnata devices follow their own spacing rules, and Sunnata dimmers require a neutral conductor in the switch box. Wired shading systems such as Lutron Sivoia QS require a four conductor power and communication cable that runs from a power panel to each shade location, either directly or linked from shade to shade. Motorized shades are the feature homeowners most often regret omitting, so even if they are not in this year's budget, prewire every window. You can then add them room by room later without disturbing a finished surface.

5. Unify everything under one intuitive platform

No one wants a phone crowded with twenty disconnected apps. An automation platform such as Control4 orchestrates lighting, shades, music, video, climate, surveillance, and access into a single, coherent experience. Pair it with Josh.ai, whose AI X operating system introduced scenes you can create simply by describing them in plain language, and your home responds to natural conversation from a company that has long emphasized privacy.

Interoperability is also maturing quickly. Matter 1.5, released in late 2025, extended the open smart home standard to cameras and to a unified model for shades, gates, and garage doors. Selecting your platform early allows us to position keypads, touch panels, and speakers precisely where they belong before the walls close.

Bring your integrator to the table early

Our most successful projects begin the same way: a walkthrough during framing with the builder, the electrician, and the homeowner together. We annotate every speaker, keypad, display, access point, and camera directly on the plans, so the electrician knows exactly where boxes and power are required. That single meeting routinely saves weeks of rework and a meaningful amount of money.

Planning a new home or a major renovation? We would be delighted to review your plans at no cost. Book a consultation or call us at (781) 506-6008.

Sources

WiFi Alliance: WiFi CERTIFIED 7 announcement
Ethernet Alliance: Overview of IEEE 802.3bt
Lutron: RadioRA 3 installation FAQ
Lutron: Wiring Sivoia QS shades
CE Pro: Josh.ai releases AI X OS
Josh.ai: Privacy
Connectivity Standards Alliance: Matter 1.5
audioXpress: CEDIA Expo 2026 and power

If that pattern sounds familiar, you are in good company, and there is encouraging news: the problem is almost always solvable. In our experience, the internet circuit is rarely at fault. The weak link is the network inside the building. Here is what we most often uncover when a business asks us to diagnose unreliable WiFi, and what a durable solution looks like.

The provider's gateway is overextended

Many offices still route everything through the combination modem and router their provider installed on day one. That single appliance is simultaneously routing traffic, acting as the firewall, assigning addresses, and attempting to blanket the entire floor with wireless coverage. It was never engineered for dozens of employees, printers, conference room displays, and a camera system.

The situation often worsens when a second router is added behind it. This creates what engineers call double NAT, a condition Google's support documentation notes can cause problems with port forwarding and UPnP, and can stop a computer on one network from reaching a printer on the other. The remedy, where the provider's equipment supports it, is to place that equipment in bridge mode and let a business grade firewall take command, which also gives you genuine visibility into what is happening on your network.

Coverage is assumed rather than engineered

Radio signals attenuate rapidly through walls, glass, elevator shafts, and filing cabinets. A lone access point in a corner leaves distant users clinging to a marginal connection, and their devices roam, disconnect, and reconnect throughout the day. Ubiquiti's guidance, for instance, treats a signal of about negative 65 dBm as the target for dependable performance, with negative 70 dBm as the practical floor.

Achieving that consistently requires a deliberate design. We begin with a site survey, then position multiple ceiling mounted access points, each cabled back to a switch. In dense environments we deliberately moderate transmit power and use narrower channels so neighboring access points complement rather than compete with one another. On the crowded 2.4 GHz band, only channels 1, 6, and 11 avoid overlapping one another in the United States, so careful channel planning matters enormously.

You are not yet using the 6 GHz band

This is one of the most exciting developments in business networking. In 2020 the FCC opened 1,200 MHz of spectrum in the 6 GHz band for unlicensed use, dramatically expanding the room available for WiFi. WiFi 6E and WiFi 7 devices can operate there with far less congestion than the legacy bands.

WiFi 7 builds on that foundation with 320 MHz channels and Multi Link Operation, which allows a compatible laptop to send and receive data over more than one link at the same time for higher throughput and greater resilience. Adoption is accelerating rapidly: the Wireless Broadband Alliance, citing ABI Research, reports that WiFi 7 access point shipments are forecast to climb from roughly 66.5 million in 2025 to nearly 118 million in 2026. If your access points are several generations old, a refresh can be transformative.

Every device shares a single network

Guests, staff laptops, security cameras, smart televisions, and payment terminals should not coexist on one flat network. CISA, the federal Cybersecurity and Infrastructure Security Agency, describes segmentation as dividing a network into separate segments, each functioning as its own subnetwork, precisely to strengthen security and control. In practice, that means a compromised guest phone or an outdated camera cannot reach your file server or accounting platform. Segmentation also reduces unnecessary broadcast traffic, which quietly improves performance.

Cabling and switching are holding you back

A modern access point is only as capable as the cable and switch behind it. We frequently find new equipment running over aging cable and plugged into inexpensive unmanaged switches. Category 6A cabling supports 10 gigabit Ethernet across a full 100 meter channel, and managed switches with Power over Ethernet provide both data and power to access points from a single, centrally protected location. The IEEE 802.3at standard delivers 25.5 watts to a device, while 802.3bt raises that to as much as 71.3 watts, comfortably powering today's high performance access points.

No one is monitoring the network

Networks are dynamic. Firmware requires updates, new devices appear, and neighboring businesses introduce equipment that competes for the same channels. Without monitoring, problems surface as complaints rather than alerts. Modern platforms increasingly apply artificial intelligence to this challenge; Ubiquiti's UniFi Channel AI, for example, analyzes the radio environment and recommends better channel assignments that an administrator can apply in a few clicks. Combined with proactive managed IT support, many issues are resolved before your team ever notices.

What a lasting solution looks like

Our process begins with an on site assessment. We map signal strength, test the cabling, evaluate your firewall and switching, and review how devices are segmented. We then design a network on proven business platforms such as Ubiquiti UniFi, install it meticulously, and document everything so you always retain full ownership and control of your infrastructure.

Ready to retire the frozen calls and dead zones for good? Schedule a network assessment or call us at (781) 506-6008.

Sources

Google: Double NAT explained
Ubiquiti: Optimizing WiFi connectivity
FCC: 6 GHz unlicensed operations fact sheet
WiFi Alliance: WiFi CERTIFIED 7
Wireless Broadband Alliance: 2026 predictions
CISA: Network segmentation
Ethernet Alliance: IEEE 802.3bt overview
Ubiquiti: UniFi Channel AI

The encouraging reality is that video security has never been more capable. Today's systems deliver remarkable clarity, intelligent search, and tight integration with door access, provided they are designed thoughtfully. Here is how we approach a modern deployment.

Design every view around a clear objective

Before selecting a single camera, we walk the property and ask what each field of view must accomplish. The international standard IEC 62676 4 formalizes this idea by defining the pixel density needed for each task. Its 2014 edition introduced the familiar DORI levels: detect, observe, recognize, and identify. Identifying a face requires far more pixels across the target than simply detecting motion in a parking lot.

Notably, the 2025 edition replaced those levels with seven new ones, and in Axis Communications' summary, the level used to validate a known person calls for 500 pixels per meter. The practical lesson is straightforward: a camera at the entrance should be specified to identify faces, a camera at the lot entrance to capture vehicles, and a camera above a register to reveal hands and transactions. Purposeful placement is what separates actionable evidence from terabytes of unusable video.

Choose IP cameras powered over Ethernet

Legacy analog systems produce soft, low resolution imagery. Contemporary IP cameras record in 4K and beyond, perform impressively in low light, and draw both power and data through a single network cable. Installations are cleaner, and additional cameras can be introduced later without new electrical work at each location. Efficient compression such as H.265 helps keep storage demands manageable, although the real savings depend on the scene and the camera.

Insist on compliant, trustworthy hardware

This is an area where regulation has moved decisively. Section 889 of the National Defense Authorization Act restricts federal agencies, contractors, and grant recipients from obtaining video surveillance equipment from Hikvision, Dahua, and Hytera when it is used for public safety, government facility security, critical infrastructure, or other national security purposes. In November 2022 the FCC stopped authorizing new Hikvision and Dahua equipment intended for those security uses, and a June 26, 2026 FCC public notice extended the prohibition to importing and marketing previously authorized models for those purposes.

Those rules do not make existing installations unlawful to operate, but they have profound implications for support, replacement, and risk. A Department of Homeland Security bulletin reported by ABC News in February 2025 warned that Chinese manufactured cameras typically lack data encryption and, by default, communicate with their manufacturer. For any new installation, we recommend NDAA compliant hardware from reputable manufacturers.

Build a recording architecture you can rely on

A network video recorder should be sized for the retention period your insurer, industry, or internal policy requires, and we calculate that capacity using manufacturer design tools rather than rules of thumb. The recorder belongs in a secure, ventilated space on battery backup, so a power interruption never creates a gap in the record.

Hybrid architectures are increasingly popular: footage is retained locally for performance, while critical cameras are also backed up to the cloud. Should a recorder be stolen or damaged, the evidence endures.

Search with intelligence, not endurance

Artificial intelligence has fundamentally changed how video is reviewed. Modern platforms classify people and vehicles and let you search by time, location, and event type, so a question such as who approached the rear door last Tuesday is answered in seconds rather than hours. The Security Industry Association ranked the disruption of security software by artificial intelligence as its top megatrend for 2026, and the pace of innovation is genuinely thrilling. Remote viewing also lets you check on every location from your phone, wherever you happen to be.

Unify video with access control

Physical keys are copied, lost, and rarely returned. Card, fob, and mobile credentials let you grant or revoke access instantly, apply schedules to each door, and maintain a precise audit trail. Mobile credentials are gaining remarkable momentum: in HID's 2025 industry survey, 61 percent of security leaders identified them as a top trend.

How readers communicate matters as well. The Open Supervised Device Protocol, known as OSDP and published as international standard IEC 60839 11 5, is a far more capable alternative to legacy Wiegand wiring, and its Secure Channel mode encrypts reader traffic with AES 128. When access control and video operate on a unified platform, every door event is paired with its corresponding footage, which makes investigations remarkably efficient.

Isolate cameras from your business network

Connected cameras are a well documented entry point for attackers when they share a network with computers and servers. We place all security devices on a dedicated, protected network segment, keep firmware current, and disable features that expose cameras directly to the internet. It is a modest investment that substantially reduces risk.

Plan for growth from the outset

Whether you operate one location or a growing portfolio, choose a platform that manages every site from a single dashboard. It saves owners and managers considerable time and keeps security policies consistent everywhere.

We design and install intelligent camera and access control systems for businesses, restaurants, and residences. Request a complimentary site survey or call us at (781) 506-6008.

Sources

Axis Communications: Pixel density under IEC 62676 4 (2025)
U.S. Election Assistance Commission: NDAA Section 889
FCC: Public notice DA 26 635
ABC News: DHS bulletin on internet connected cameras
Security Industry Association: OSDP
Security Industry Association: 2026 Megatrends
HID Global: 2025 State of Security report